Privacy policy

Status July 2023

The protection of personal data and the responsible handling of information that you entrust to us is an important and special concern for us. Carl Kühne KG (GmbH & Co.) ("Kühne", "we", "us") processes personal data only in accordance with the statutory regulations. These are in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). 

This privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") when

  • you visit our website https://www.kuehne-international.com (paragraphs 2 - 8)
  • you visit our company pages on a social network (section 12),
  • contact us by e-mail or via the contact form (section 13),
  • register for our newsletter (see section 14),
  • you take part in a competition (see paragraph 15),
  • we conclude a contract (clause 17) and
  • apply for a job with us (point 18).

This privacy policy also contains information about recipients of personal data within the EEA (see section 20), in third countries (see section 21), the deletion of your personal data and retention periods (see section 22), your rights as a data subject (see section 23) and automated decision-making (see section 24).

1. responsible person and data protection officer

You can contact our data protection officer at Carl Kühne KG & Co. GmbH, Data Protection Officer, Kühnehöfe 11, 22761 Hamburg, datenschutz@kuehne.

2. data processing to enable the use of our website

When you visit our website, we collect personal data to enable you to use it (usage data). This includes your IP address and data about the start, end and purpose of your use of the website. This also includes the technical data transmitted by your browser, such as browser type / browser version, the previously visited website (referrer URL), monitor resolution, operating system, device information (e.g. device type), etc., if applicable. We process this usage data for the provision and needs-based design of our website in our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR).

For security reasons (e.g. to investigate misuse or fraud), this data is stored for a maximum of seven days and then deleted. Data whose further storage is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

3. cookies & web analysis

The website uses cookies. Cookies are text files that are placed and stored on a computer system via an Internet browser. When you visit our website again, cookie data is transmitted to our web server. This allows us to recognize you, for example, and take your individual settings into account when displaying the website. There are cookies that are absolutely necessary to ensure the technical functionality of the website. The legal basis for the use of technically necessary cookies is our legitimate interest in the provision of our website in accordance with Art. 6 para. 1 lit. f GDPR.

Other cookies may be used in the context of web analysis. They can be combined with other information about your activities on our website and are processed in pseudonymized user profiles. This helps us to analyze information about web traffic and improve our website in order to adapt it to the needs of website visitors. We only use this information for statistical evaluations. The legal basis for the use of other cookies and web analytics is your consent in accordance with Art. 6 para. 1 lit. a GDPR. Your consent also covers any data transfers associated with the use of cookies, in particular to the USA (see also section 21).

When accessing our website, the website visitor is informed about the use of cookies for analysis purposes by displaying a corresponding banner and their consent to the processing of the personal data used in this context is obtained. Reference is also made to this privacy policy. Only if you consent to the setting of all cookies used by us will we set other, non-essential cookies. Before you give your consent, only technically necessary cookies will be set.

In addition to our cookie banner, you can restrict your consent to the setting of cookies in whole or in part by configuring your browser settings accordingly and deactivating the setting of cookies in whole or in part. In addition, you can install a plugin in your browser to protect your privacy, which offers the option of preventing web analyses - e.g. AdBlock, Ghostery or NoScript (please refer to the data protection information of the respective plugin provider). Furthermore, some web analytics providers are members of industry associations whose websites allow you to centrally prevent usage-based online advertising and web analytics by the respective members. Below you will find the websites of these associations for convenient cross-provider prevention of web analysis. In this way, you can also prevent the creation of pseudonymous user profiles.

  • "European Interactive Digital Advertising Alliance" (EDAA): http://www.youronlinechoices.com/de/praferenzmanagement/
  • "Digital Advertising Alliance (DAA): www.aboutads.info/choice
  • "Network Advertising Initiative (NAI): http://optout.networkadvertising.org/?c=1
  • If you do not give your consent to the use of cookies or delete cookies from your end device, this may affect your ability to use the website or individual functionalities. Detailed information on the individual cookies used on our website can be found in the table displayed by our cookie consent tool if you click on the button with the fingerprint in the footer on the left-hand side of our website.

 4. consent with Usercentrics

Our website uses the consent management platform of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to obtain your consent to the storage of certain cookies in your browser or to the use of certain technologies and to document these in compliance with data protection regulations.

When you enter our website, a Usercentrics cookie is stored in your browser, in which the consents you have given or the revocation of these consents are stored. The consent management platform is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c) GDPR.

Details on data processing by Usercentrics can be found at  https://usercentrics.com/de/datenschutzerklaerung/

5. google analytics

This website uses Google Analytics, a web analysis service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), if you have given us your consent to do so via the cookie banner. Google Analytics uses cookies (see section 3) to enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand and thus anonymized. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there (see also section 21 on data transfers to the USA). Google will use this information on our behalf for the purpose of evaluating your use of this website, compiling reports on website activity and providing other services relating to website activity and internet usage to Kühne. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can revoke your consent to the web analysis and the use of cookies in this regard as well as the data transfer to the USA as follows: You can prevent the storage of cookies by setting your browser software accordingly and rejecting them or using a privacy plug-in (see section 3). You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de). Alternatively, you can prevent the collection of data by Google Analytics by placing an opt-out cookie on your computer. Use the following link to do this: Set opt-out cookie. Alternatively, you can revoke your consent by clicking on the "Revoke Google Analytics" button. In this case, we will set a technically necessary cookie that recognizes your withdrawal of consent when you visit our website.

Revoke Google Analytics
6. google tag manager

This website uses Google Tag Manager to manage website tags. A tag is a JavaScript snippet that is used to send information from a website to third parties, particularly in the context of web tracking. The Google Tag Manager tool itself does not collect any personal data. The tool triggers other tags, which in turn may collect data (e.g. the Google Analytics tag). Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager. This makes it easier for you to effectively prevent tracking procedures.

7. Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively by analyzing, for example, which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

The use of Google Ads is based on Art. 6 para. 1 lit. a) GDPR, namely your consent, which we obtain via the cookie banner and which you can revoke at any time with effect for the future.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

8. Facebook, Custom Audiences and Facebook marketing services

We use the so-called "Facebook pixel" of the social network Facebook, which is operated by Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are based in the EU, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

With the help of the Facebook pixel, it is possible for Facebook to determine the visitors to our website as a target group for the display of ads (so-called "Facebook ads"). Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products that are determined based on the websites visited) that we transmit to Facebook (so-called "custom audiences"). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion"). processing takes place exclusively on the basis of your consent given via the cookie banner in accordance with Art. 6 Para. 1 lit. a) GDPR; consent can be revoked at any time with effect for the future.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Further information on data transfer outside the EU/EEA can be found in section 21.

Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Insofar as personal data is collected on our website and forwarded to Facebook when using Facebook Pixel/Custom Audiences, we and Facebook are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The processing carried out by Facebook after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in an agreement on joint processing. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

You can find further information on protecting your privacy in Facebook's privacy policy: https://de-de.facebook.com/about/privacy/.

You can also deactivate the remarketing function "Custom Audiences" in the settings for advertisements at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do this.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

Tracking via the Facebook pixel on this website is activated. Click here to deactivate tracking.

9. Adform

We use the platform of Adform A/S, Silkegade 3B, ST. & 1st, 1113 Copenhagen, Denmark (Adform) for digital advertising.  

Adform enables us to place advertisements on third-party websites and mobile applications. Furthermore, targeted advertisements can be displayed based on the user data available at Adform (e.g. location data and interests) (target group targeting). Adform also provides technologies that enable the display of advertising content on a website or mobile app. As website operators, we can also use Adform to measure the effectiveness of ads and forecast the reach of ads. Adforms primarily processes device information and sets cookies.

The use of Adforms is based on Art. 6 para. 1 lit. a) GDPR, namely your consent, which we obtain via the cookie banner and which you can revoke at any time with effect for the future.

Further information on data processing by Adform can be found here: https://site.adform.com/privacy-center/platform-privacy/product-and-services-privacy-policy/.

10. Sentry

We use the error analysis service Sentry from Functional Software Inc., 45 Fremont Street, 8TH Floor, San Francisco, California 94105, USA) as an analysis tool to improve the technical stability of our website by monitoring system stability and identifying code errors in real-time tracking. Sentry serves these purposes alone and does not analyze data for advertising purposes. Sentry also processes your data in the USA, among other places (see also section 21). Sentry is contractually obliged to process your personal data in accordance with the EU standard contractual clauses.

User data, such as information on the device or time of the error, is collected anonymously and is not used for personal purposes and is subsequently deleted. The data is stored on third-party servers until the error that caused it is rectified. Cookies are used for this purpose. By deactivating cookies in the browser settings, you can object to the collection and storage of data by Sentry at any time with effect for the future. The Sentry analysis tool is used on the basis of Art. 6 para. 1 lit. f GDPR, as there is a legitimate interest in solving errors to improve our products. The setting of cookies, unless they are technically necessary cookies, requires your consent in accordance with Art. 6 para. 1 lit. a GDPR. We obtain this consent via the cookie banner if required.

For more information, please refer to Sentry's privacy policy: https://getsentry.com/privacy/.

11. social networks and embedded YouTube videos

Our website contains links to social networks (e.g. Facebook or Instagram) and embedded videos from the YouTube streaming service. These services are operated exclusively by third-party providers. If you follow the links or play videos, information may be transmitted to these providers. We use the so-called "double-click" solution for links to social networks. This means that when you visit our site, no personal data is passed on. Only if you click on one of the social share buttons or watch embedded videos will data be transmitted to the respective provider. The purpose and scope of the data collection and the further processing and use of the data by the provider as well as your rights in this regard and setting options to protect your privacy can be found in the data protection information of the respective provider. You can find this here:

12. joint responsibility with social network operators

We maintain company pages on the social networks of Facebook, Instagram, Pinterest, TikTok, YouTube and Xing. As the operator of these pages, we are responsible for the collection (but not the further processing) of the data of visitors to our company pages together with the respective operator of the social network.

  • Facebook: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
  • Instagram: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
  • Pinterest: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
  • TikTok: Bytedance Pte Ltd, 8 Marina View, Singapore 018960
  • Xing: New Work SE (until July 2019 Xing SE), Am Strandkai 1, 20457 Hamburg, Germany
  • YouTube: YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA

Controller within the meaning of the General Data Protection Regulation (GDPR). 

The data collected includes 

  • information about the types of content visitors view or interact with, or the actions they take, and
  • Information about the devices used by visitors (e.g. IP addresses, operating system, browser type, language settings, cookie data).
  • Social networks also collect and use information to provide analytics services, known as "site insights", to site operators to help them understand how people interact with their sites and the content associated with them. 

We have concluded a special agreement with the respective operator of the social network: 

In particular, these regulate which security measures the operator must observe and in which the operator has agreed to fulfill the rights of data subjects (i.e. users can, for example, address information or deletion requests directly to the operator of the social network).

The rights of visitors (in particular to information, deletion, objection and complaint to the supervisory authority) are not restricted by the agreements with the respective operator. You can assert your rights (information, rectification, erasure, restriction of processing, data portability, objection and complaint) both against us and against the respective operator of the social network. 

  • Purposes of Processing: Contact requests and communication, Tracking (e.g. profiling based on interests and behavior, use of cookies), Remarketing, Web Analytics (e.g. access statistics, recognition of returning visitors).
  • Legal basis: The legal basis for data processing is our legitimate interest in the most comprehensive possible presence of our offer and our company on the Internet as well as the possibility of communicating with you via social networks (Art. 6 para. 1 letter f GDPR).
  • Data subjects: Website visitors, visitors to our company pages on social networks.

Facebook, Instagram, Pinterest, TikTok and YouTube may also process some of the information collected outside the European Union, e.g. in the USA. We would like to point out that the USA is not a safe third country within the meaning of EU data protection law (see also section 21). Data transfers are always carried out on the basis of standard contractual clauses. The operators of the social networks and their affiliated companies are therefore contractually obliged to process data in compliance with data protection law.

Further information on the handling of personal data can be found in the privacy policies of Facebook, Instagram, YouTube, Pinterest, TikTok and Xing.

13. contact by e-mail or contact form and user inquiries

When you contact us by e-mail or via a contact form, the data you provide (e-mail address, name and telephone number if applicable) will be stored by us in order to answer your questions and process your request. This information is used to specify your request and to improve the processing of your request. This information is expressly provided on a voluntary basis. The legal basis is either the fulfillment of a contractual obligation, measures to initiate a contract or our legitimate interest in providing a contact form (Art. 6 para. 1 lit. b and lit. f GDPR). You are not obliged to contact us via the contact form or by email, nor are you obliged to provide personal data. If you do not provide your personal data, we may not be able to process your request. Otherwise, there will be no consequences for you.  

User data may be stored in our Customer Relationship Management System ("CRM System").

We use the ticket and support system of Zendesk, Inc., 1019 Market Street in San Francisco, CA 94103 USA ("Zendesk") to process user inquiries.

We use Zendesk to process your requests quickly and efficiently. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement (DPA) with Zendesk. This ensures that Zendesk only uses the user data within the framework of EU data protection standards exclusively for processing the requests and does not pass them on to third parties. When using Zendesk, data may also be transferred to the USA (see also section 21). Zendesk has Binding Corporate Rules (BCR) that have been approved by the Irish Data Protection Authority. Data transfers may be based on BCRs.

Further information on data processing by Zendesk can be found in Zendesk's privacy policy: https://www.zendesk.de/company/customers-partners/privacy-policy/.

14. newsletters and advertising e-mails

We only send newsletters, emails and other electronic notifications with advertising information (hereinafter "newsletter") with the consent of the recipient or with legal permission. If the contents of the newsletter are specifically described when registering for the newsletter, they are decisive for the user's consent. Our newsletters also contain information about our products, offers, promotions and our company. To subscribe to the newsletter, it is sufficient to enter your e-mail address. Optionally, we ask you to provide a name so that we can address you personally in the newsletter.

Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that no-one can register with other people's e-mail addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address.

We use the service provider Newsletter2Go GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, hereinafter referred to as the "newsletter service provider", to send the newsletter. You can view the data protection provisions of the mailing service provider here: https://www.newsletter2go.de/datenschutz/.

Performance measurement - The newsletters contain a so-called "web-beacon", i.e. a pixel-sized file that is retrieved from the server of the mailing service provider when the newsletter is opened. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval, is initially collected. This information is used for the technical improvement of the services. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. These evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

We will also add you to our mailing list in order to send you advertising for our own similar goods or services by e-mail if you purchase goods or services from us and have not previously objected to this processing of your e-mail address.

The newsletter is sent and its success measured on the basis of the recipient's consent in accordance with Art. 6 para. 1 lit. a, Art. 7 GDPR in conjunction with Section 7 para. 2 no. 3 UWG or on the basis of legal permission in accordance with Section 7 para. 3 UWG. The registration process is logged on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR and serves as proof of consent to receive the newsletter.

Newsletter recipients can unsubscribe from our newsletter at any time and revoke their consent. You can object to e-mail advertising at any time. You will find an unsubscribe link at the end of each newsletter. Your consent to receive the newsletter and to the performance measurement will expire at the same time. Unfortunately, it is not possible to revoke the performance measurement separately; in this case, you must unsubscribe from the entire newsletter subscription. When you unsubscribe from the newsletter, your personal data will be deleted, unless their retention is legally required or justified. In this case, their processing will only be limited to these exceptional purposes. In particular, we may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them for the purposes of sending the newsletter in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against claims.

15. participation in competitions

We occasionally offer competitions on our website. In the event of participation, we will use the data you provide during registration (e.g. name, address, e-mail address) for the purpose of implementing the participation contract, in particular for notifying you of the prize. Data will only be passed on to third parties if this is necessary for the processing of the competition (e.g. sending the prize). If you have given your consent in the context of a competition, you have the option of withdrawing this consent at any time with effect for the future. After the end of the competition, we will delete the data immediately, unless we are entitled to process certain data from you beyond the end of the competition on the basis of the agreement on your participation in the competition or as a result of your consent. You may find additional information in the conditions of participation. The data processing is based on Art. 6 para. 1 sentence 1 lit. b) GDPR and, in the event that you have given your consent, on Art. 6 para. 1 sentence 1 lit. a) GDPR.

16. FriendlyCaptcha

To protect your participation in the competition, we use the FriendlyCaptcha service provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Woerthsee ("Friendly Captcha"). The query is used to distinguish whether the input is made by a human or abusively by automated, machine processing. The query includes sending the IP address and any other data required by Friendly Captcha for the service to Friendly Captcha. For this purpose, your input is transmitted to Friendly Captcha and used there. The deviating data protection provisions of Friendly Captcha, available at https://friendlycaptcha.com/de/legal/privacy-end-users/, apply to this data.

17. provision of contractual services and business initiation

If you contact us as an interested party, supplier, service provider or other business partner, we process your personal data, such as contact details or correspondence, insofar as this is necessary to process your request (legitimate interest pursuant to Art. 6 (1) (f) GDPR) or to initiate or execute the respective business transaction (Art. 6 (1) (b) GDPR) and, if necessary, retain the data within the scope of statutory retention obligations (on the basis of statutory obligations pursuant to Art. 6 (1) (c) GDPR).

The same applies if you are an employee of an interested party, supplier, service provider or other business partner and we receive your personal data in this context; the legal basis in this case is our legitimate interest in initiating or conducting the business relationship with your employer (Art. 6 (1) (f) GDPR).

18. Data processing when applying for a job with us

You can apply to us by e-mail, online via our career portal at https://www.kuehne.de/karriere or by post. Within the application process, regardless of whether the application is made by e-mail, online or by post, we process your personal data, usually name, address, e-mail address, telephone number, marital status, qualifications, any other personal information from your cover letter and CV as well as any attachments (including CV and certificates) that you may include. We may also process the preferred location where you would like to start with us, your salary expectations in EUR/year, the possible starting date and the position (job title) for which you are applying.

The processing is carried out for the purpose of establishing contact, assessing your suitability for the position for which you are applying and carrying out the application procedure. The legal basis is the initiation of an employment relationship with you (Art. 6 para. 1 lit. b GDPR). The personal data provided by you as part of a specific application process will be treated confidentially. Access to your data is granted to the responsible Kühne employees who are involved in the relevant personnel selection process.  Your applicant data will not be used or passed on for any other purpose.

If we are currently unable to offer you a vacancy, but based on your profile we come to the conclusion that your application could also be of interest for other positions, we will store your application data in our applicant pool for a maximum of 12 months, provided you have given us your consent to do so in accordance with Art. 6 Para. 1 lit. a) GDPR. So that we can contact you again at a later date.

If you are suitable for inclusion of your data in our applicant pool, we will inform you accordingly in a separate email and obtain your consent before including you in the applicant pool. You can revoke your consent to the continued storage of your applicant data at any time, e.g. by sending an e-mail to our HR department at bewerbung-hamburg@kuehne.de. Your personal data will be automatically deleted from the applicant pool after a maximum of 12 months.

If your application is unsuccessful, this data will be deleted six months after completion of the application process, unless you have expressly consented to longer storage. If we conclude an employment contract with you, the data transmitted will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. You are not obliged to provide us with your personal data. However, we would like to point out that your application cannot be considered if you do not provide us with your personal data. There will be no further consequences for you.

19. safety measures

In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, appropriate technical and organizational measures to ensure a level of security appropriate to the risk; the measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, disclosure, safeguarding of availability and their separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data and response to data threats. Furthermore, we take the protection of personal data into account as early as the development and selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and data protection-friendly default settings (Art. 25 GDPR).

To protect the personal data of our users, we use a secure online transmission method, the so-called "Secure Socket Layer" (SSL) transmission. You can recognize this by the fact that an "s" is appended to the address component http:// ("https://") or a green, closed lock symbol is displayed. By clicking on the symbol, you will receive information about the SSL certificate used. The display of the symbol depends on the browser version you are using. SSL encryption guarantees the encrypted and complete transmission of your data.

20. data recipient

We only pass on the personal data described here insofar as this is necessary for the provision of our services or is required by law in this context. Within the scope of the purposes stated here, personal data is forwarded to service providers who work for us and support us in particular in the provision of services. In addition to their legal obligation to comply with all data protection regulations, these service providers are bound by further contractual data protection requirements. In particular, this includes an obligation as a processor in accordance with Art. 28 GDPR. 

Otherwise, we only transfer personal data to other recipients if we have legal permission to do so or if you have given your prior consent. You can revoke any consent you have given at any time with effect for the future. We only pass on your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision and only insofar as this is permitted under data protection law.

21 Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services, in particular in the context of the processing or disclosure or transfer of data to third parties described in sections 3-8 and sections 10-14, this will only take place if it is done to fulfill our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Data will only be transferred to recipients outside the EU or the EEA if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the transfer of data. If you have any questions about this, please contact our data protection officer (section 1).

22. deletion of data

Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate grounds on the part of Kühne to the contrary or in the event of a revocation there is no other legal basis for the processing. In certain cases, e.g. if there is a legal obligation to retain data, your personal data will initially be blocked and deleted upon expiry of the retention period. This applies, for example, to data that must be retained for commercial or tax law reasons.

23 Rights of the data subjects

Data protection law grants you a number of rights in relation to data concerning your person (so-called data subject rights). In general, these are

  • the right to request information about the personal data we have stored about you (Art. 15 GDPR),
  • the right to rectification of inaccurate data (Art. 16 GDPR),
  • the right to erasure of data that may no longer be stored (Art. 17 GDPR),
  • the right to restriction of processing in certain cases (Art. 18 GDPR),
  • the right to data portability, i.e. to transfer data that you have provided in electronic form to you or to a third party (Art. 20 GDPR) and
  • the right to withdraw any consent given with effect for the future (Art. 7 (3) GDPR). Please note that we will continue to store your consent if you withdraw it. This is because we must be able to provide evidence of consent even after it has been withdrawn and your personal data deleted. The legal basis for the (continued) storage of consent is Art. 6 para. 1 lit. c in conjunction with Art. 5 para. 1 lit. a, para. 2, Art. 7 para. 1 GDPR and Art. 6 para. 1 lit. f GDPR.

You can also object to the processing if it is based on legitimate interests (Art. 6 para. 1 lit. f GDPR) or Art. 6 para. 1 lit. e GDPR (Art. 21 para. 1 GDPR) or for direct marketing purposes (Art. 21 para. 2 GDPR), whereby you must provide a specific reason, except in the case of direct marketing.

Whether and to what extent these rights exist in individual cases and which conditions apply is determined by the law, i.e. the GDPR and the BDSG. You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us. If you have any questions or complaints about data protection at Kühne, we recommend that you first contact our data protection officer (see the contact details in section 1).

24. no automated decision in individual cases

We do not use your personal data for automated individual case decisions within the meaning of Art. 22 para. 1 GDPR.

25. changes and updates to the privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.